You have an Azure subscription named Sub1 that contains the resources shown in the following...

Yes, Yes, No

The deployment stack uses -DenySettingsMode DenyDelete, which protects managed resources from deletion but does not block normal write operations. Microsoft’s deployment stack documentation defines DenySettingsMode values as None, DenyDelete, and DenyWriteAndDelete; only DenyWriteAndDelete blocks updates. Therefore, Admin1 can modify the IP address space of VNet2 because Admin1 has Network Contributor at the subscription scope and the deny mode does not block write operations.

Admin2 has Contributor at RG2, which normally grants full management access to resources in RG2, except access management. Subnet2 is a child resource of VNet2. The command does not include DenySettingsApplyToChildScopes; Microsoft states that this parameter must be specified for deny settings to apply to child scopes of managed resources. Therefore, Admin2 can delete Subnet2.

Admin3 has Owner at the VNet2 scope, but the deny assignment applies to All principals , has no excluded principals, and is scoped to VNet2. Deny assignments block access even when a role assignment grants it, so Admin3 cannot delete VNet2. Study Guide reference: AZ-104 Manage Azure identities and governance , Azure RBAC, deny assignments, and governance controls.